From the co-chairs of the AAMI working group that wrote TIR115
AAMI TIR115 Cloud Readiness for Medical Devices
Understand where your cloud approach stands and what to address next.
AAMI TIR115:2026 provides new guidance for using public cloud computing to enable medical device functions. Orthogonal helped author and lead the development of the guidance, with Chief Solutions Officer Randy Horton serving as co-chair of the AAMI working group. We help MedTech teams translate TIR115 into practical decisions across architecture, supplier management, risk, change control, testing, and postmarket monitoring.
Why TIR115 Matters Now
Turn TIR115 Guidance Into an Actionable Cloud Strategy
Using public cloud infrastructure means relying on computing resources that may be essential to your medical device but are operated and changed by a third party.
TIR115 gives manufacturers a framework for identifying those dependencies and managing their risks. Orthogonal helps you apply that guidance to your specific device, architecture, and quality system.
Trusted by venture-backed startups to large medical device companies
COMING SOON
Join TIR115 Readiness Checklist Waitlist
From Guidance to Implementation
TIR115 gives you the framework. Your device still needs a practical plan
Every medical device uses cloud infrastructure differently. The appropriate approach depends on the device, intended use, architecture, cloud services, risk profile, and how those services are managed within the manufacturer’s QMS.
That is where a Cloud Readiness Assessment comes in.
TIR115 Cloud Readiness Assessment
Know Where You Stand and What to Address Next
Our fixed-scope, fixed-fee TIR115 Cloud Readiness Assessment evaluates your current cloud approach against key concepts in TIR115. Over 3-4 weeks, we review your architecture, cloud dependencies, quality resources, and risk management approach and identify areas that may need additional attention.
Our assessment looks at:
- Which device functions are appropriate for public cloud based on their intended use and risk
- Where your MDS ends and your MDDE begins
- How cloud service providers and purchased services are qualified and managed
- How cloud dependencies are reflected in your risk-management activities
- How change control accounts for provider-initiated changes
- Whether your architecture and testing strategy address a continuously changing cloud environment
- How cloud-related risks and changes are monitored after release
Define the Medical Device Boundary
Know What Is Part of the Device and What It Depends On
TIR115 distinguishes between the Medical Device System (MDS) and the Medical Device Digital Environment (MDDE).
The MDS includes components identified as part of the medical device, while the MDDE includes computing resources required for the device to function but that are not regulated as part of the MDS.
Getting that boundary right affects how cloud components are managed, how risks are evaluated, and how changes to the environment are handled.
Manage Public Cloud as a Purchased Service
Apply the Right Controls to Infrastructure You Do Not Directly Manage
TIR115 says the public cloud environment should be managed as a purchased service, while components of the MDDE should not be treated as software of unknown provenance (SOUP).
That shifts the focus toward evaluating the cloud service provider, understanding the services your device depends on, and using technical and supplier-management controls appropriate to the risk.
Build for Continuous Change
Keep Cloud-Native Development Moving Without Losing Control
Public cloud environments change frequently, sometimes with little or no advance notice from the provider.
TIR115 addresses practices such as staging environments that mirror production, Infrastructure as Code (IaC), automated testing, periodic full regression testing, and postmarket monitoring to help manufacturers evaluate the impact of those changes.
Orthogonal helps teams build those practices into their architecture and development process so cloud change can be managed without unnecessarily slowing release cadence.
This also helps connect TIR115 to Orthogonal’s broader engineering and test-automation capabilities.
Our TIR115 Cloud Readiness Process
1. Review
We start with your medical device architecture, cloud dependencies, quality processes, and existing risk-management approach.
2. Assess
We examine how your current practices relate to key TIR115 concepts, including MDS/MDDE boundaries, supplier management, risk, and cloud change.
3. Prioritize
We identify areas that may require additional attention based on your architecture, intended use, and risk profile.
4. Roadmap
You receive a prioritized path forward so your team knows what to address first and where deeper work may be needed.
Prepare Your Cloud Strategy for TIR115
Whether you already rely on public cloud infrastructure or are designing a new cloud-enabled medical device, Orthogonal can help you evaluate your approach relative to TIR115 and identify what to address next.
Frequently Asked Questions
What is AAMI TIR115?
AAMI TIR115:2026, Guidance for the appropriate use of public cloud computing to enable medical device functions, provides guidance for stakeholders using public cloud computing to support regulated medical device functions.
What was Orthogonal’s role in AAMI TIR115?
Orthogonal played a leadership role in developing AAMI TIR115. Chief Solutions Officer Randy Horton co-chaired the AAMI Cloud Computing Working Group alongside Pat Baird of Philips, while Founder and CEO Bernhard Kappe and VP, Regulatory & Quality Megan Graham also contributed to the development of the guidance.
Who should use TIR115?
TIR115 is relevant to medical device manufacturers, cloud technology providers, regulatory professionals, and others involved in designing, deploying, maintaining, or overseeing medical devices that depend on public cloud computing.
Has FDA recognized AAMI TIR115?
TIR115 has been submitted to FDA for consideration as a recognized consensus standard. FDA recognition is a separate process and is not guaranteed.
Does TIR115 replace AAMI CR510?
Yes. TIR115:2026 supersedes AAMI CR510:2021 and provides expanded guidance for the design, deployment, maintenance, and management of public cloud computing used to enable medical device functions.
Is TIR115 mandatory?
No. AAMI Technical Information Reports are voluntary guidance documents. Manufacturers can evaluate how their practices align with TIR115 based on their devices, intended use, architecture, and risk profile.
What is the difference between the MDS and MDDE?
The Medical Device System, or MDS, consists of components identified as part of the medical device. The Medical Device Digital Environment, or MDDE, includes computing components required for the device to function but that are not regulated as part of the MDS.
Does TIR115 require manufacturers to stop using SOUP?
No. TIR115 says components of the MDDE should not be treated as SOUP. SOUP components may still exist within the MDS. The public cloud environment is instead approached as a purchased service.
How should cloud service providers be managed?
TIR115 recommends a supplier risk-management approach that considers both the technical suitability of cloud resources and the cloud service provider’s ability to deliver and maintain those services over time.
Does TIR115 only apply to public cloud computing?
The formal scope of TIR115 focuses specifically on public cloud computing used to enable regulated medical device functions. However, Orthogonal has explored how the broaded concept of indirect control may help teams think about other external dependencies, including smartphones and third party AI models
What does a TIR115 Cloud Readiness Assessment include?
Orthogonal reviews your cloud architecture, MDS/MDDE boundary, supplier-management approach, risk management, change control, and related cloud practices, then provides a prioritized roadmap identifying areas to address.
TIR115 Resources
Article
TIR115 Announcement
Article
Indirect Control as the New Paradigm for Medical Devices
COMING SOON
Join TIR115 Readiness Checklist Waitlist
AAMI TIR115:2026 Guidance
Prepare Your Cloud Strategy for TIR115
Whether you already rely on public cloud infrastructure or are designing a new cloud-enabled medical device, Orthogonal can help you evaluate your approach relative to TIR115 and identify what to address next.
